Abstract: In the host intrusion detection method based on kernel module abstraction some system calls of the same kernel module have different behaviors，and different kernel modules also contain system calls with similar behaviors, which causes confusion of abstract mapping of behavior and affects the detection performance．This paper proposes a host intrusion detection method based on system call behavior similarity clustering．Firstly，Word2Vec is utilized to construct continuous dense word vector to extract multi-dimensional semantic similarity information of system call behavior，and then the clustering algorithm is utilized to make abstract represent of system call which reduce the confusion of behavior abstract mapping．The results of the experiment based on ADFA-LD and ADFA-WD datasets show that the method can effectively reduce the confusion of abstract mapping of behavior and improve the detection performance．At the same time，the efficiency of detection can be greatly improved by selecting different number of clusters，which has great practical value．

Key words: behavior similarity, Word2Vec, clustering, system call, host-based intrusion detection

摘要： 基于内核模块抽象的主机入侵检测方法中，同一内核模块的部分系统调用存在较大行为差异，且不同内核模块也含有行为相似的系统调用，造成行为抽象映射的混淆，影响检测效果．提出了一种基于系统调用行为相似性聚类的主机入侵检测方法，首先利用Word2Vec构建连续稠密词向量实现多维度系统调用行为语义相似性信息提取，再使用聚类算法对系统调用进行抽象表征减小行为抽象映射的混淆．基于ADFA-LD和ADFA-WD数据集的实验结果表明，方法能够有效降低行为抽象表征的混淆，提升检测效果．同时，可通过选取聚类簇数较大幅度提高检测时间效率，实用价值大．

关键词: 行为相似性, Word2Vec, 聚类, 系统调用, 主机入侵检测